ERTMS/ATO is the European interoperable system enabling automatic train operation in the presence of a driver. This autopilot works together with the European signalling system ERTMS/ETCS, whose constraints it must comply with, while also respecting the train timetable.

In this article, we will explore the principles of Automatic Train Operation in GoA2, and the implementation of ERTMS/ATO within the harmonised ERTMS system.

For a good understanding of the concepts discussed in this article, I recommend reading first:

1. Automatic Train Protection
2. Automatic Train Operation
3. ERTMS: the European Rail Traffic Management System
4. ERTMS/ETCS: the European Train Control System

Article summary

In Grade of Automation GoA1, driving assistance systems can already be used to regulate speed or provide driving recommendations, for example for eco-driving. These functions remain continuously supervised by the train protection system: the ATP.

In GoA2, the system is able to drive the train automatically, based on a set of input data: the mission timetable and the signalling constraints to be respected.

Automatic train operation offers clear benefits. It can reduce energy consumption through optimised driving. Since the ATO algorithm is connected to the ATP, it can drive as close as possible to the signalling limits, and therefore intensify the use of the infrastructure. It also harmonises the driving behaviour of a fleet of trains, reducing timetable dispersion during operations.

This releases additional capacity, which can then be used to run more trains.

These benefits have motivated the introduction of automatic train operation in relatively homogeneous and closed environments: metro systems. Integrated and proprietary systems called CBTC are widely used in this context. However, CBTC cannot be used as such on the national railway network, where interoperability is mandatory.

This is why interoperable automatic train operation was developed: ERTMS/ATO. This autopilot works in tandem with the ERTMS/ETCS ATP and is now fully part of the ERTMS system. It has been integrated into the Technical Specification for Interoperability – Control-Command and Signalling.

To unlock the full potential of ERTMS/ATO, and to bring a line close to its maximum capacity potential, two fundamental elements of the railway system must be modernised.

First, the ATP, by moving towards a radio-based level of ERTMS/ETCS.

Second, the TMS, by using highly automated traffic management systems.

This triptych — ERTMS/ETCS Level 2, next-generation TMS and ERTMS/ATO — will become increasingly important in the coming years to enable mass transit on the national railway network, and therefore contribute to modal shift towards rail.

Last modified: 2026-05

Content

1. Introduction
   1. The creation of ERTMS/ATO
   2. Definitions of ERTMS/ATO
   3. Decomposition of ERTMS/ATO
2. Journey Profiles & Segment Profiles
   1. General principles
   2. Journey Profiles
   3. Segment Profiles
3. The interaction between ATO On-board and ATO Trackside
   1. ATO Trackside
   2. ATO On-board
4. The driving funtion of ERTMS/ATO
5. Interaction with the driver
6. ERTMS/ATO architecture
7. ERTMS/ATO prototyped and tested
8. Perspectives
   1. Migration to ERTMS/ATO
   2. Increasing capacity with ERTMS/ETCS Level 2
   3. Increasing capacity with modernised Traffic Management
   4. ERTMS/ATO up to GoA4
9. Conclusion 

1. Introduction

This chapter is based on SUBSET-125 version 1.0.0.

1.1 The creation of ERTMS/ATO

When ERTMS/ETCS was designed, there was no provision for adding an autopilot system capable of automatically managing train traction and braking in the presence of a driver, corresponding to GoA2.

From the 2010s onwards, operators and manufacturers joined forces to design and specify an automatic driving option working with ERTMS/ETCS: ATO over ETCS, also called AoE.

ATO over ETCS was integrated into the 2023 revision of the Technical Specification for Interoperability – Control-Command and Signalling, and more generally into the ERTMS system. This is why ATO over ETCS is now officially called ERTMS/ATO.

ERTMS/ATO is now the reference solution for implementing automatic train operation on the national railway network, and by extension on the future Single European Railway Area.

1.2 Definitions of ERTMS/ATO

ERTMS/ATO provides a set of non-safety functions related to automatic traction and braking, accurate train stopping, automatic door opening and closing, and other functions usually under the responsibility of the driver.

ERTMS/ATO covers several use cases, from assisted manual driving, corresponding to GoA1 C-DAS, up to fully automated operation, corresponding to GoA4. The level of automation supported on a given route depends on both the rolling stock and the trackside infrastructure.

ERTMS/ATO is compatible with ERTMS/ETCS ATP in Levels 1 and 2.

However, the ERTMS/ATO specification, SUBSET-125, does not cover:

• the use of ERTMS/ATO without ERTMS/ETCS onboard equipment;
• GoA3 and GoA4 automation levels.

This is an important point. In its current standardised scope, ERTMS/ATO is primarily a GoA2 system working with ETCS. The transition towards GoA3 and GoA4 requires additional specifications, systems and operational concepts.

1.3 Decomposition of ERTMS/ATO

ERTMS/ATO is decomposed into two subsystems:

• ATO Trackside: a gateway connected to existing information systems. ATO Trackside retrieves timetable data and track layout information from Traffic Management Systems, through an interface that is not standardised. This is because TMS are existing systems and are specific to each infrastructure manager.
• ATO Onboard: the autopilot that controls the train. It receives timetable and track layout data from ATO Trackside in a standardised format, in order to guarantee interoperability.

Image: ERTMS/ATO system overview, with onboard and trackside equipment. Credit: Siemens.

This decomposition illustrates the architectural purpose of ERTMS/ATO. The trackside part adapts local operational data into a standardised format. The onboard part uses this standardised information to drive the train in an interoperable way.

2. Journey Profiles and Segment Profiles

2.1 General principles

When a driver operates a train, they follow the mission that has been assigned to them. This mission is defined by the timetable sheet: with this document, the driver knows at what time they are expected to pass a given station or a specific point on the line.

The driver uses this timetable sheet to manage traction and braking, in order to be neither too early nor too late.

ATO Onboard has the same objective. It must respect the timetable that has been assigned to it. To do so, it relies on an input data element called the Journey Profile.

2.2 Journey Profiles

The Journey Profile defines the route of a given train through the infrastructure, and lists a set of Segment Profiles describing the tracks that the train will run on.

The Journey Profile contains information allowing ATO Onboard to know:

• the route through the infrastructure, by providing a list of track segments, called Segment Profiles, which ATO Onboard must request from ATO Trackside:
  • Segment Profile identifiers;
  • Segment Profile versions;
  • direction of movement on the Segment Profiles;
• operational data corresponding to the mission, containing a list of:
  • Timing Points and their identifiers;
  • arrival time and associated tolerance;
  • Timing Point alignment;
  • and other characteristics described in clause 6.4.2.1 of SUBSET-125;
• possible network constraints, such as speed restriction areas, degraded adhesion areas, or ATO inhibition areas.

The Journey Profile is the starting point. It refers to a second input data element for ATO Onboard: the characteristics of the track that will be used by the route through the infrastructure. This is the Segment Profile.

2.3 Segment Profiles

The Segment Profile contains information describing the tracks of the route through the infrastructure, as required by the Journey Profile.

ATO Trackside must therefore send to ATO Onboard the Segment Profiles containing the track data required for the operation of ATO Onboard.

The content of the Segment Profile can be found in clauses 6.4.3.2 and 6.4.3.3 of SUBSET-125.

3. The interaction between ATO Trackside and ATO Onboard

3.1 ATO Trackside: the mailbox

ATO Trackside is an application that can run on one or several servers. It is connected to the TMS, and more generally to the infrastructure manager’s information systems.

ATO Trackside continuously retrieves timetable data and track layout properties made available by the TMS and by the infrastructure manager’s IT tools. It adapts this information into the standard format: Journey Profiles and Segment Profiles.

Onboard the train, the ATO Onboard subsystem is responsible for automatic driving. When ATO Onboard starts up, it knows the IP address of its reference ATO Trackside. It then opens a connection and asks ATO Trackside whether it has a mission for it.

If this is the case, ATO Trackside sends it a Journey Profile. ATO Onboard can then request the associated Segment Profiles from ATO Trackside.

If there is no mission for this ATO Onboard, it will continue to query ATO Trackside regularly.

ATO Trackside therefore acts as a mailbox. It converts specific information coming from the TMS and from the infrastructure manager’s IT tools into the standard JP + SP format, and sends it to the relevant ATO Onboard.

The connection between ATO Onboard and ATO Trackside can use public 2G, 3G, 4G or 5G networks, or the mobile network dedicated to railway applications: GSM-R and, in the future, FRMCS.

3.2 ATO Onboard: the autopilot in control

ATO Onboard is the autopilot that controls train traction and braking.

To do this, ATO Onboard uses the Journey Profile and Segment Profiles sent by ATO Trackside, in order to perform the mission.

In addition, ATO must drive the train while respecting the signalling information transmitted to it. If it does not, ETCS applies emergency braking.

This is the key principle of ATO over ETCS: ATO drives the train, but ETCS remains the safety supervision layer. ATO is an operational automation system; ETCS is the safety protection system.

Image: standardised ERTMS/ETCS and ERTMS/ATO systems. Standardised interfaces are shown in orange.

4. The driving function of ERTMS/ATO

ERTMS/ATO relies on a set of functions. One of them is the driving function, on which we will focus.

The ATO driving function is decomposed into four sub-functions:

1. Time Table Speed Management
   With this function, ATO Onboard calculates a speed profile whose objective is to arrive on time at the Timing Points defined in the Journey Profile, while minimising energy consumption as much as possible. This speed profile is called the Optimum Speed Profile.
2. Supervised Speed Envelope Management
   With this function, ATO Onboard calculates the maximum speed profile that the train can follow without being taken over by ETCS.
3. Automatic Train Stopping Management
   With this function, ATO Onboard calculates a speed profile allowing the train to stop automatically at the Stopping Points.
4. ATO Traction / Brake Control
   With this function, ATO Onboard generates commands to the train in order to follow the ATO Operational Speed Profile. This profile is the combination of the speed profiles produced by TTSM, SSEM and ATSM. The train then uses these commands to apply traction and braking.

Image: ATO driving function.

This functional decomposition shows that ATO is not only a speed control algorithm. It is a system function combining timetable compliance, signalling supervision, stopping accuracy and rolling stock control.

5. Interaction with the driver

ATO is a new system for the driver. The interaction between the driver and the autopilot must therefore be as smooth as possible, in order not to add additional complexity.

The ERTMS/ATO solution uses the ERTMS/ETCS interface screen: the DMI, or Driver Machine Interface.

The DMI displays information to the driver about:

• the state of the system;
• mission data;
• time;
• the next stop.

The driver can engage or disengage ATO by pressing buttons. It is also through the DMI that the driver enters the train data required by both ERTMS/ETCS and ERTMS/ATO.

In GoA2, the driver remains in the cab. The system automates traction and braking, but the driver continues to supervise the operation and can take over when necessary.

6. ERTMS/ATO architecture

Image: ERTMS/ATO architecture.
Source: SUBSET-125 version 1.0.0.

The figure above represents the architecture of the complete system:

• ERTMS/ATO in green, described in SUBSET-125;
• ETCS onboard signalling in light grey, described in SUBSET-026;
• driver, train and legal recorder in dark grey.

This architecture immediately shows the internal and external interfaces of the ERTMS/ATO system.

FFFIS interfaces, standing for Form-Fit Function Interface Specification, allow component interchangeability. They are plug-and-play interfaces.

This means, for example, that it is possible to use an ETCS onboard system from one supplier with an ATO onboard system from another supplier.

The internal interface is the one between ATO Trackside, also called ATO/DAS Trackside, and ATO Onboard, also called ATO/DAS Onboard. This is SUBSET-126. This interface allows the transmission of Journey Profiles and Segment Profiles. SUBSET-148 specifies the transport and security layers of this interface.

In order to drive the train within the limits permitted by the signalling system, ATO Onboard receives signalling information from ETCS Onboard through the SUBSET-130 interface. The ERTMS/ETCS specification, SUBSET-026 version 4.0.0, specifies the evolutions allowing support for ERTMS/ATO. SUBSET-143 specifies the communication layers of the interface.

When ATO commands traction and braking to the train, it communicates with the rolling stock control-command system. This communication is performed through the SUBSET-139 interface. SUBSET-147 specifies the communication layers of the interface.

Existing trains are not natively able to provide this interface. Adaptations of the rolling stock are therefore required for the implementation of ATO Onboard.

This architecture is one of the major differences between ERTMS/ATO and proprietary automation systems. ERTMS/ATO is not designed as a closed integrated system. It is designed as an interoperable system, based on standardised interfaces between onboard, trackside, ETCS and rolling stock subsystems.

7. ERTMS/ATO prototyped and tested

In parallel with the design of the system and its documentation, the manufacturers involved in the working group developed prototypes.

These prototypes were tested on simulation platforms, especially to verify interoperability. For each reference test, ETCS Onboard, ATO Trackside and ATO Onboard were all provided by different manufacturers, in order to verify that the whole system operated correctly thanks to standard interfaces.

ERTMS/ATO was also tested on a British train.

The ERTMS/ATO solution was also tested in France, on the Longwy–Longuyon line equipped with ERTMS/ETCS Level 1. The BB27000 locomotive of the Train de Fret Autonome project, equipped with an Alstom ERTMS/KVB bi-standard system and with ERTMS/ATO, ran in October 2020 for the experiment.

8. Perspectives

8.1 Migration towards ERTMS/ATO

ERTMS/ATO only works if the ERTMS/ETCS onboard equipment is in a mode of full safety supervision of the train, called Full Supervision mode.

However, ERTMS/ETCS can only be in Full Supervision mode if the track is equipped with ERTMS/ETCS. The deployment of this system takes time.

This situation creates a problem for railway undertakings wishing to deploy automatic train operation without waiting, especially in order to benefit from reduced energy consumption. The use of the ERTMS/ATO solution is therefore coupled with the deployment of ERTMS/ETCS on the tracks.

To address this difficulty, experiments are being conducted with an ERTMS/ATO solution based on visual perception of lineside signalling.

In January 2022, the teams of the Train de Fret Autonome project demonstrated the feasibility of automatic train operation using the standard ERTMS/ATO GoA2 solution, fed by visual perception and lineside signalling conversion systems.

This migration topic is essential. ERTMS/ATO is the target interoperable architecture for driving automation, but railway networks are existing systems. They contain legacy signalling, existing rolling stock, operational constraints and long investment cycles. The transition towards automation must therefore be progressive.

8.2 Increasing capacity with ERTMS/ETCS Level 2

The ERTMS/ATO system uses ERTMS/ETCS as ATP, and ERTMS/ATO can be used with both ETCS Level 1 and Level 2.

Level 1 is semi-punctual for the transmission of signalling data between trackside and onboard. It therefore does not allow a line to reach its maximum capacity potential.

Level 2, on the other hand, is based on continuous radio transmission. Therefore, from an ERTMS/ETCS point of view, bringing a line close to its maximum capacity potential requires the installation of Level 2.

An additional capacity increase can be obtained through variants of Level 2, such as Moving Block or Hybrid Train Detection.

This is why Level 2 is the reference solution of the target system towards which the Single European Railway Area must tend.

8.3 Increasing capacity with modern TMS

We have seen that the ERTMS/ATO system uses a trackside gateway, ATO Trackside, in order to connect to the infrastructure manager’s traffic management information systems.

The performance and responsiveness of operations depend directly on the performance of this traffic management IT system.

Moving towards mass transit, with reduced headways between trains and automatic train operation, requires powerful and highly automated Traffic Management Systems.

This automation allows the TMS to manage a large number of automatically driven trains on the same line, and to anticipate potential slowdowns on the line thanks to the statuses sent by ATO systems to the trackside.

Note: in this article, I systematically use the term TMS, Traffic Management System, to designate traffic management IT systems. This term is used in the mainline context. In the urban context, we would rather use ATS, Automatic Train Supervision.

8.4 ERTMS/ATO up to GoA4

The next step for the ERTMS/ATO system is to move from GoA2 automation towards GoA3 and GoA4.

Where GoA2 allows the theoretical capacity of a line to be used as much as possible, GoA4 offers operational flexibility and the possibility to adapt the transport offer very dynamically. Since trains operate without onboard personnel, it becomes much easier to inject or remove trains from a line according to demand.

Specification work for GoA4 began in 2019 within the Shift2Rail X2RAIL-4 project and ended in December 2023 with the publication of a first document. Specification, prototyping and demonstration work now continues within the R2DATO project.

These results will feed the standardisation activity of the System Pillar, in order to update the Technical Specifications for Interoperability accordingly.

The transition from GoA2 to GoA3 and GoA4 opens technical challenges:

• environmental perception;
• hazard detection;
• decision-making based on hazards.

New technologies are required:

• computer vision;
• satellite-assisted absolute localisation and inertial navigation;
• automation functions and autonomous decision-making.

In August 2025, the R2DATO project had already published specifications on the use cases of automation functions and perception. These documents are available at the end of the article.

Beyond technical aspects, implementing a fully automated transport system, corresponding to GoA4, on the national railway network represents a major challenge of system architecture, migration strategy for existing systems, and more generally transformation of the way railway operations are performed.

These challenges are just as complex as the technical challenges mentioned above.

Conclusion

In Grade of Automation GoA1, driving assistance systems can already be used to regulate speed or provide driving recommendations, for example for eco-driving. These functions remain continuously supervised by the train protection system: the ATP.

In GoA2, the system is able to drive the train automatically, taking into account a set of input data: the mission timetable and the signalling constraints to be respected.

Automatic train operation offers clear benefits. It can reduce energy consumption through optimised driving. Since the ATO algorithm is connected to the ATP, it can drive as close as possible to the signalling limits, and therefore intensify the use of the infrastructure. It also harmonises the driving behaviour of a fleet of trains, reducing timetable dispersion during operations.

This releases additional capacity, which can then be used to run more trains.

These benefits have motivated the introduction of automatic train operation in relatively homogeneous and closed environments: metro systems. Integrated and proprietary systems called CBTC are widely used in this context.

However, CBTC cannot be used as such on the national railway network, where interoperability is mandatory.

This is why interoperable automatic train operation was developed: ERTMS/ATO. This autopilot works in tandem with the ERTMS/ETCS ATP and is fully part of the ERTMS system. It is now integrated into the Technical Specification for Interoperability – Control-Command and Signalling.

To unlock the full potential of ERTMS/ATO, and to bring a line close to its maximum capacity potential, two fundamental elements of the railway system must be modernised.

First, the ATP, by moving towards a radio-based level of ERTMS/ETCS.

Second, the TMS, by using highly automated traffic management systems.

This triptych — ERTMS/ETCS Level 2, automated TMS and ERTMS/ATO — will become increasingly important in the coming years to enable mass transit on the national railway network, and therefore contribute to modal shift towards rail.

ERTMS/ATO is therefore not only an autopilot. It is an interoperable automation layer within a broader European railway system. Its deployment requires not only onboard and trackside technologies, but also system architecture, standardised interfaces, traffic management modernisation and long-term migration strategies.

This is why ERTMS/ATO is one of the key building blocks of the future automated European railway system.

ERTMS/ATO documentation

Documentation related to the Technical Specification for Interoperability – Control-Command and Signalling, 2023

• SUBSET-125: ERTMS/ATO System Requirements Specification, version 1.0.0
• SUBSET-126: ATO-OB / ATO-TS FFFIS Application Layer, version 1.0.0
• SUBSET-148: ATO-OB / ATO-TS FFFIS Transport & Security Layers, version 1.0.0
• SUBSET-130: ATO-OB / ETCS-OB FFFIS Application Layer, version 1.0.0
• SUBSET-139: ATO-OB / Rolling Stock FFFIS Application Layer, version 1.0.0
• SUBSET-143: Interface Specification Communication Layers for onboard communication, version 1.0.0
• SUBSET-147: CCS Consist Network Communication Layers FFFIS, version 1.0.0
• 13E154: ERTMS/ATO Glossary, version 2

Documentation from European collaborative R&D programmes

Europe’s Rail Joint Undertaking programme, 2021+

• R2DATO project: documentation of use cases for perception system
• R2DATO project: documentation of use cases for automating functions
• R2DATO project: documentation of freight-specific user requirements for automation process
• R2DATO project: documentation of urban use cases and operational rules for automation process
• R2DATO project: ATO up to GoA4 specifications review documentation

Shift2Rail programme, 2014–2021

• X2RAIL-4 project: ATO up to GoA4 specification
• X2RAIL-4 project: ATO up to GoA4 tests report
• TAURO project: technologies supporting the migration to ERTMS/ATO
  • Lineside Signalling Interpretation report
  • Digital Map report
  • ATO/TMS headway stability analysis report
• TAURO project: ATO automatic functional test report
• TAURO project: ATO running capability report